
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
node-clhash
Advanced tools
Node.js library that provides bindings for the CLHash C library (https://github.com/lemire/clhash).
⚠️ The package compilation requirements are the same as the CLHash library requirements (see https://github.com/lemire/clhash#requirements).
To install the package run the following command:
$ npm install node-clhash
# Or if you use yarn
$ yarn add node-clhash
The get_random_key_for_clhash
uses posix_memalign
internally and needs to be the key pointer to be aligned. The library does not expose binding for the get_random_key_for_clhash
and doesn't allow the user to generate its key. Instead, it generates the key and then the hashed value and returns both values to the user:
const { clhash } = require('node-clhash');
// Generate synchronously.
const { key, hashed } = clhash.sync('my long string');
console.log({ key, hashed }); // { key: 5067639175440424385n, hashed: 8451564168848164053n }
// Generate asynchronously.
clhash('my long string', (error, { key, hashed }) => {
console.log({ key, hashed }); // { key: 5067639175440424385n, hashed: 8451564168848164053n }
});
The key
and hashed
values are BigInt
. The clhash
returns uint64_t
, which is unsigned long long
. The maximum uint64_t
value is 2 ^ 64 - 1
and the maximum JavaScript integer value is 2 ^ 53 - 1
(Number.MAX_SAFE_INTEGER
).
FAQs
Bindings for the CLHash C API to the Node.js world
The npm package node-clhash receives a total of 1 weekly downloads. As such, node-clhash popularity was classified as not popular.
We found that node-clhash demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.